CmdID

CmdID / Commands

htop

Display dynamic real-time information about running processes. tldr-pages

On several platforms 1 Sigma rule name it

Several platforms

from tldr-pages, CC BY 4.0

Display dynamic real-time information about running processes. An enhanced version of top.

Start htop

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Start htop displaying processes owned by a specific user

htop --user usernameIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Display processes hierarchically in a tree view to show the parent-child relationships

htop --treeIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Sort processes by a specified sort_item (use htop --sort help for available options)

htop --sort sort_itemIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Start htop with the specified delay between updates, in tenths of a second (i.e. 50 = 5 seconds)

htop --delay 50Identify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Disable all system and process changing features

htop --readonlyIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

See interactive commands while running htop

<F1>

Switch to a different tab

<Tab>

What detects it

Sigma process creation rules that name htop

lowProcess DiscoveryÖmer Günal, oscd.community, CheraaghiMilad